From 943cc3ec2a468cbe8beab8d1f6db8b71fdcf5487 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Mon, 6 Jan 2025 14:26:00 +0100
Subject: [PATCH] Bug 38829: Add a test

Signed-off-by: Magnus Enger <magnus@libriotech.no>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Added a shebang line.
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
---
 t/db_dependent/Serials/Claims.t | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/t/db_dependent/Serials/Claims.t b/t/db_dependent/Serials/Claims.t
index 47113a6372..94edcdae9f 100755
--- a/t/db_dependent/Serials/Claims.t
+++ b/t/db_dependent/Serials/Claims.t
@@ -1,5 +1,7 @@
+#!/usr/bin/perl
+
 use Modern::Perl;
-use Test::More tests => 17;
+use Test::More tests => 18;
 
 use C4::Acquisition;
 use C4::Budgets qw( AddBudgetPeriod AddBudget );
@@ -168,3 +170,12 @@ my $today = output_pref( { dt => dt_from_string, dateformat => 'iso', dateonly =
 
 # FIXME: This test should pass. The GetLateOrMissingIssues should not deal with date format!
 #is( $serial_claimed->{claimdate}, $today, 'The serial should have been claimed today' );
+
+subtest 'prevent SQL injections' => sub {
+    plan tests => 1;
+    my $time1 = time;
+    my $hack  = q|1 OR (SELECT 1 FROM (SELECT(SLEEP(10)))x)-- -|;
+    GetLateOrMissingIssues($hack);
+    my $time2 = time;
+    ok( $time2 < $time1 + 10, 'The sleep should not be executed' );
+};